[GHSA] GHSA-h6cx-gjxx-v25c (medium) — Sulu: Media move/update authorization bypass (IDOR)

GHSA-h6cx-gjxx-v25c Severity: medium CVE: CVE-2026-82395

Sulu: Media move/update authorization bypass (IDOR)

### Impact

A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.

The media move endpoint resolves its permission check from the `collection` value in the request rather than from the media's real collection. `MediaManager::